Server no longer applies GPO's?

  • Thread starter Thread starter BSB
  • Start date Start date
B

BSB

I have two metaframe servers that I applie GPO settings
for user profiles. I redirect desktop and start menu's as
well as provide a list of favorites for IE for them. For
some reason over the weekend one of the two servers
stopped applying some of the GPO's. What seems strange is
that one of the GPO's (for scripts) seems to be running
but the ones for folder redirects and IE fail everytime.
My second server seems to have no problem implementing the
GPO's from the DC.

What utility can I use to assist in finding out why the
one server has failed to implement the GPO? I ran
gpresult which indicates that everything is running fine.
When I look in the event viewer I do get a couple of
errors on folder redirection yet the server that is
working has some of the same errors.

Thanks for the help.
 
Try adding into the registry of the client the following
key. It will provide more information in the Event log
application so that you can see step by step what is
taking place.

hkey_local_Machine\software\Microsoft\WindowsNT\CurrentVers
ion\Diagnostics\RunDiagnosticLoggingGroupPolicy
Set the data value ot 1 or the loggin won't run.

HTH

Rich
 
Also, not sure if you are aware, but there is a "bug"
(Microsoft calls it a feature) that can disable Group
Policy if the user is in too many groups (nested or
otherwise). See Q327825. We actually apply a reg hack
to get around this issue. Not sure if this is your
problem, but it is exactly what happened to us and how we
fixed it.
Here is the REG file we use:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\K
erberos\Parameters]
"MaxTokenSize"=dword:000186a0
 
I will try the registry hack and see if it helps. The
problem that I am seeing is only dealing with one server.
We run two citrix servers. one server runs the GPO
correctly the other server ignores any GPO that deals with
IE. Favorites will not import nor will the homepage change
to the correct page. Almost as if I have a problem with IE
on that one server. I can use IE on that server and don't
get any unusual errors with it. I just don't get the
policy.

Thanks for the help.

-----Original Message-----
Also, not sure if you are aware, but there is a "bug"
(Microsoft calls it a feature) that can disable Group
Policy if the user is in too many groups (nested or
otherwise). See Q327825. We actually apply a reg hack
to get around this issue. Not sure if this is your
problem, but it is exactly what happened to us and how we
fixed it.
Here is the REG file we use:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\K
erberos\Parameters]
"MaxTokenSize"=dword:000186a0
-----Original Message-----
Try adding into the registry of the client the following
key. It will provide more information in the Event log
application so that you can see step by step what is
taking place.

hkey_local_Machine\software\Microsoft\WindowsNT\CurrentVe rs
ion\Diagnostics\RunDiagnosticLoggingGroupPolicy
Set the data value ot 1 or the loggin won't run.

HTH

Rich


.
Click to expand...
.
Click to expand...
 
Back
Top